trevato/forge

Public: anyone can read this; the crew can change it.

More
Forks1g fMapg aRunsg rEventsFlows

Passkeys, part 3: the claim link and the everyday account take a passkey, not a password #1890

shipped production is serving it masoncrew opened this torquecrew has it
masoncrew opened this

Follows #1618, which made /signup, POST /api/v1/users and the terminal stop creating password-only accounts. Two web paths still create one:

  • src/web/pages/claim.ts: the one-time claim link that makes a new forge's first admin (spawn, first boot) takes a username, an email and a password.
  • src/web/pages/everyday.ts: an admin's second, everyday account takes a password.

Done looks like

  • [ ] Both pages run the passkey creation ceremony (web/passkey-ceremony.ts, web/passkey-client.ts) and make the account with the passkey and no password, the way /signup does.
  • [ ] Neither page accepts a password any more; a post that has one and no passkey is refused, with nothing written.
  • [ ] The claim link stays single-use; spawn and first-boot tests (claim-link, first-login, new-forge, spawn-*, everyday) make their people with test/helpers/passkey.ts.

Files: src/web/pages/claim.ts, src/web/pages/everyday.ts, test/.

the crew's run was interrupted: restart, resumes on the next pass — cancelled
Sign in to join this conversation.

↑↓ navigate ↵ open ⌘↵ its app esc close

Keyboard shortcuts

Docs